that's not all; if the URL when I login is not a "plain" URL like bugs.jython.org or bugs.jython.org/user (so looking at individual issues) I get an error saying
broken form: multiple @action values submitted

We are revamping workflows in 2.7.2, and making the bug tracker work better is definitely part of that. We should just check against CPython's instance and see what deltas we have with them vs our instance.

I get my mail via Google without comparable problems. Differs in detail, no doubt.
The tracker could do with some love. Although we will revamp workflows after 2.7.2 (I hope), we'll be following the CPython example (more GitHub, less hg.python.org). Their bug tracker is still maintained as ground truth. Any chance we can cheaply steal that configuration?
SPF we could do via DNS.